[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa3oFT1PYFB0m8T9rpHLLN1lybVZyRnK5xGmeKvrKqZk":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":115},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4fe80979-19e5-45a4-b561-de6739f2d7bc",".NET 11 security changes target the software supply chain","net-11-security-changes-target-the-software-supply-chain-814bb2","Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support. .NET 10 is still the Long Term Support (LTS) option. The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development. Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle. .NET 8 and .NET 9 are out of support The most urgent item for defenders isn’t a new feature. .NET 8 … More → The post .NET 11 security changes target the software supply chain appeared first on Help Net Security.","Microsoft has released .NET 11, a Standard Term Support release, which includes several security enhancements. Key changes focus on software supply chain integrity, such as a new minimum package publication age setting for NuGet to create a 'cooldown' period for new package versions. Container publishing now produces reproducible image digests. The release also improves authentication handling for SignalR connections and Blazor components, and enhances crash reporting with managed stack traces for incident investigation.",".NET 11 security updates include supply chain controls, authentication improvements, and crash reporting.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fnet-11-security-changes\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12084105\u002Fdot_net-1600.webp","2026-11-12T08:23:33+00:00","2026-11-12T09:00:16.187623+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},".NET 11","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":19},".NET 10",{"name":26,"type":19},".NET 8",{"name":28,"type":19},".NET 9",{"name":30,"type":31},"ASP.NET Core","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[],[21,18,24],{"controls":53,"vendors":111},[54,82],{"slug":55,"name":56,"problem":57,"products":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":76,"vendor_name":21,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":83,"name":84,"problem":85,"products":86},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[112],{"slug":76,"name":21,"logo_path":77,"roles":113},[114],"reported_by",{"slug":116,"title":117,"body":118,"framework_refs":119,"framework_notes":125},"net-11-hardens-nuget-and-container-pipelines-against-supply-chain-attacks",".NET 11 Hardens NuGet and Container Pipelines Against Supply Chain Attacks","Microsoft's .NET 11 release directly addresses software supply chain risks by introducing a minimum package publication age for NuGet, creating a cooldown period that reduces the window for typosquatting and malicious package injection attacks. Without such controls, attackers can publish rogue packages and exploit the brief window before organizations or maintainers detect the threat. Reproducible container image digests further ensure that the artifact built is exactly the artifact deployed, closing a common integrity gap. These changes highlight how supply chain threats increasingly target the development toolchain itself, not just production systems.",[120,121,122,123,124],"NIS2 Article 21(2)(d)","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 16: Application Software Security (v8)","MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools","NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems",{"NIS2 Article 21(2)(d)":126,"NIST SP 800-53 SA-12: Supply Chain Protection":127,"CIS Control 16: Application Software Security (v8)":128,"MITRE ATT&CK T1195.001: Compromise Software Dependencies and Development Tools":129,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":130},"This point specifically requires organizations to address security risks in their supply chain, including software dependencies and package repositories, which is precisely what the NuGet cooldown and reproducible digest controls target.","SA-12 requires organizations to protect against supply chain threats by employing countermeasures throughout the system development lifecycle, directly covering the risk of malicious packages being injected via NuGet.","CIS Control 16 requires managing the security of software throughout its lifecycle, including vetting third-party components, which aligns with enforcing package age policies and verifying container image integrity.","This technique describes adversaries inserting malicious code into software dependencies (such as NuGet packages) to compromise downstream consumers, which the .NET 11 cooldown period is specifically designed to mitigate.","This category calls for identifying, assessing, and managing risks associated with suppliers and third-party software components, directly applicable to governing NuGet package consumption and container base images."]